Ofcom has told online platforms that, from 30 September 2026, they should have automated hash matching in place to detect and prevent the sharing of illegal intimate images, including explicit AI-generated deepfakes, under the Online Safety Act 2023. It has opened a monitoring programme to check compliance.
Key points
- The expectation applies to platforms providing services to UK users, wherever they are based.
- Services that do not use hash matching must show that their systems curb non-consensual intimate image abuse in an equally effective way.
- Ofcom is working with SWGfL, which runs the StopNCII.org hash database and the Revenge Porn Helpline.
- Ofcom will consult by the end of 2026 on strengthening its Illegal Harms Codes, including removal of reported intimate images within 48 hours.
- Failures can lead to fines of up to 10% of global annual revenue.
If you run a user-to-user or file-sharing service with UK users, confirm that hash matching (or an equivalent you can evidence) is live, record it in your illegal content risk assessment, and make sure reporting and takedown processes can meet a 48-hour target. Ofcom’s separate call for evidence on online harms to women and girls closes on 6 November 2026.
Source: Ofcom
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
